Capstone — Three Data-Loss Tickets, Start to Finish

Every connected and network-accessible backup is gone, exactly the pattern Chapter 3 warned about. One copy survives: an immutable offsite backup, protected by a retention lock the compromised admin credentials couldn't override — Chapter 8's own defense working exactly as intended.

Rather than assuming the surviving copy is automatically good, the team applies the same discipline Chapter 5 built for routine testing — actually restoring it to a real, isolated environment and confirming the result is genuinely usable, not just present.

The restore stalls with an unrecognized-format error. Rather than concluding the surviving backup is also bad, the team recognizes this specific signal from Chapter 7's own catalog — the backup software has been upgraded since this copy was created — and completes the restore using a compatible tool version.

Leadership is given the organization's own pre-agreed RTO, not an optimistic guess, along with a direct acknowledgment that the connected backups were lost and why the offsite copy alone made recovery possible at all.

Restoring a mid-week point in the incremental chain fails partway through. Per Chapter 2's own weakest-link warning, one corrupted incremental has broken every day after it in the chain — found only because the test restore was actually attempted, not assumed to be fine.

Checking the job's own logs per Chapter 4 reveals a warning had actually been logged the night the corruption occurred — present in the record the whole time, simply never reviewed until this test restore prompted someone to look.

Because this was caught during a scheduled test rather than during a real emergency, there's time to fix the underlying job and rerun a clean backup — exactly the outcome Chapter 5's own testing cadence exists to make possible.

Unlike Chapter 4's own ticket — where a real backup existed but had silently failed — this is a different case entirely: nothing was ever backed up here in the first place. There's no chain to check and no job log to read, because this location was simply never in scope.

The gap is a clear illustration of the difference between an assumed and an actual RPO — the user believed "everything is backed up," a belief the organization's own actual policy never supported for personal devices.

The user is told plainly and directly that this specific file cannot be recovered — no vague language about "exploring options" that were never real, per Chapter 9's own reasoning about why a direct answer is more respectful than a delayed one.